urbanterror

maintainer dundee · 23 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a full game data zip from a non-whitelisted but plausibly project-associated host (happyurtday.com, related to Urban Terror), which is then installed as data and binaries; the source is verifiable via matching sha512sum, and the build process installs only expected game files and scripts without executing remote code or exfiltrating data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a full game data zip from a non-whitelisted but plausibly project-associated host (happyurtday.com, related to Urban Terror), which is then installed as data and binaries; the source is verifiable via matching sha512sum, and the build process installs only expected game files and scripts without executing remote code or exfiltrating data.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://www.happyurtday.com/releases/4x/UrbanTerror${pkgver//.}_full.zip"

PKGBUILD

1 offending line(s) highlighted

      1# $Id: PKGBUILD 211456 2017-02-09 14:01:34Z svenstaro $
    
      2# Maintainer: Sven-Hendrik Haase <sh@lutzhaase.com>
    
      3# Contributor: grimi <grimi at poczta dot fm>
    
      4
    
      5pkgname=urbanterror
    
      6pkgver=4.3.4
    
      7pkgrel=1
    
      8epoch=1
    
      9pkgdesc="A team-based tactical shooter based on the Quake 3 Engine"
    
      10arch=('x86_64')
    
      11url="http://www.urbanterror.info"
    
      12license=('GPL2')
    
      13depends=('sdl' 'openal' 'curl')
    
      14backup=('opt/urbanterror/q3ut4/server.cfg' 'opt/urbanterror/q3ut4/mapcycle.txt')
    
      15makedepends=('mesa')
    
      16source=("http://www.happyurtday.com/releases/4x/UrbanTerror${pkgver//.}_full.zip"
    
      17        "urbanterror.sh"
    
      18        "urbanterror-server.sh"
    
      19        "urbanterror.desktop"
    
      20        "urbanterror.png")
    
      21sha512sums=('4debd6f998943cf9944ed891a3d1f3fa7d016d181d7af7cd5c28690bcd765928b4befc3f3705a4315bfa709acdd34160ed8f2d7437a54cfd10f6c48fea60af39'
    
      22            'd296cee59c9a344b03485b2400278f05d4a4edd8f782f72b10857d4654d46ff1b6f181c51abb5a718d6b4a7227601d67fb2ba2b3fe7876bfec17b7c9827525a0'
    
      23            '6f444b1203b8c1a66c86a2112f3565059ba1135940cef37208ea05933290e1b3b9d8325c7fc86466fd8646338c8deaa168a22049104bda0631eab76a21a77e51'
    
      24            '33cb13820002f6620075143a1729018caf70a7cceb9b606db295fd621833add127474f1399626d722a3a8a7d9ba001b6dada4ca877ec87251a32d616367991d4'
    
      25            'aad7cf50335d7d1a1bcb03be0cf52f8e8214e91d7ff1c76045ffed57ba599023468341a3ae07abb8b06ef2857deeae8610defdd2dc8a3e5fb48eeb3ca2033074')
    
      26
    
      27package() {
    
      28  install -d "${pkgdir}/opt/urbanterror"
    
      29
    
      30  cd "${pkgdir}/opt/urbanterror"
    
      31
    
      32  # Copy binaries.
    
      33  install -m755 "${srcdir}/UrbanTerror43/Quake3-UrT.x86_64" urbanterror
    
      34  install -m755 "${srcdir}/UrbanTerror43/Quake3-UrT-Ded.x86_64" urbanterror-ded
    
      35
    
      36  # Copy data
    
      37  cp -r "${srcdir}/UrbanTerror43/q3ut4" "${pkgdir}/opt/urbanterror/q3ut4"  
    
      38  install -Dm644 "${srcdir}/UrbanTerror43/q3ut4/readme43.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      39  echo -e "\nseta cl_cURLLib \"/usr/lib/libcurl.so.4\"" >> "${pkgdir}/opt/urbanterror/q3ut4/autoexec.cfg"
    
      40
    
      41  # Copy desktop launcher.
    
      42  install -Dm644 "${srcdir}/urbanterror.desktop" "${pkgdir}/usr/share/applications/urbanterror.desktop"
    
      43  install -Dm644 "${srcdir}/urbanterror.png" "${pkgdir}/usr/share/pixmaps/urbanterror.png"
    
      44
    
      45  # Copy launch scripts.
    
      46  install -Dm755 "${srcdir}/urbanterror.sh" "${pkgdir}/usr/bin/urbanterror"
    
      47  install -Dm755 "${srcdir}/urbanterror-server.sh" "${pkgdir}/usr/bin/urbanterror-server"
    
      48}
    
      49
    
      50# vim: sw=2:ts=2 et:
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2